Borromeo Housing Inc. 3304 Washington Blvd. Arlington, VA 22201

Web Site: https://www.borromeohousing.org Phone: 703.841.0139 Email: information@borromeohousing.org

Unless otherwise indicated, all materials in this document or presentation, and any accompanying documents and materials, are copyrighted by Borromeo Housing, Inc. All rights reserved. No part of these materials, either text or image may be used for any purpose other than personal use. Therefore, reproduction, modification, storage in a retrieval system or retransmission, in any form or by any means, electronic, mechanical or otherwise, for reasons other than personal use, is strictly prohibited without prior written permission.

United States Patent Number(s): Patents Pending. International Patent Number(s): Patents Pending.

Borromeo Housing® is a registered trademark of Borromeo Housing, Inc., 3304 Washington Blvd., Arlington, VA 22201. All other product names and company logos mentioned herein remain the trademarks of their respective owners. This Safe Harbor Privacy Policy Statement (the “Policy”) sets forth the privacy principles Borromeo Housing, Inc. (BHI) follows with respect to transfers of personally identifiable information (PII) from the European Economic Area (EEA) and Switzerland to the United States within the scope of BHI’s Safe Harbor certification.

SAFE HARBOR The U.S. Department of Commerce and the European Commission have agreed on a set of data protection principles to enable U.S. companies to satisfy requirements under European Union law related to the transfers of PII transferred from the EEA to the U.S. (the “U.S. – EU Safe Harbor”). As well, the U.S. Department of Commerce and the Federal Data Protection and Information Commissioner (FDPIC) of Switzerland have agreed on a similar set of data protection principles to enable U.S. companies to satisfy requirements under Swiss data protection law related to the transfers of PII transferred from Switzerland to the U.S. (the “U.S. – Swiss Safe Harbor”). In keeping with its commitment to protect personal privacy, BHI complies with, and has certified its adherence to, the privacy principles (the “Principles”) of both the U.S.-EU Safe Harbor and U.S. – Swiss Safe Harbor.

SCOPE This Policy applies to all PII BHI receives in the U.S. from the EEA and Switzerland, in any format.

DEFINITIONS The following key terms are used throughout this Policy: “European Union (EU)” refers to those states that are members of the EU and include Austria, Belgium, Bulgaria, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, and the United Kingdom.

“European Economic Area (EEA)” refers to those states of the EU, in addition to Iceland, Liechtenstein and Norway.

“Personally Identifiable Information (PII)”, also known as “Personal Information (PI)”, is any type of data and information relating to an identified or identifiable natural person. An identifiable natural person is a natural person who can be identified, directly or indirectly, by reference to an identification number or factors specific to his or her physical, physiological, mental, economic, cultural or social identity. Set forth below is a non-exclusive list of information that constitutes PII when such information relates to an identified or identifiable natural person, either on their own or when combined together: account number (e.g., bank account, personal/company credit card), address, biometric identifier (e.g., fingerprints or voice recordings), birth certificate or professional license number, date of birth, government identifiers (such as social security numbers or driver's license numbers), health information, name, personnel number, photograph or video identifiable to an individual. PII may also include other information related to an individual that may directly or indirectly identify the individual (e.g., in most cases salary, career history, etc.).

“Sensitive PII” is a category of PII that, according to local regulations or business decisions, requires an extra level of protection or a higher duty of care. Sensitive types of data are generally considered to be without limitation: PII specifying medical or health conditions, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership or information specifying the sexual orientation of an individual.

PRIVACY PRINCIPLES NOTICE: Where BHI collects PII directly from individuals in the EEA and Switzerland, it will inform such individuals about the purposes for which it collects and uses information about them, how to contact BHI with any inquiries or complaints, the types of third parties to which BHI discloses the information, and the choices and means BHI offers individuals for limiting its use and disclosure. Notice is provided in clear and conspicuous language when individuals are first asked to provide PII to BHI or as soon thereafter as is practicable, but in any event before BHI uses such information for a purpose other than that for which it was originally collected or processed by the transferring organization or discloses it for the first time to a third party. BHI explains the need for PII and in some cases Sensitive PII, relating to its innovative products, research and general business.

Where BHI receives PII from its subsidiaries, affiliates or other entities in the EEA and Switzerland, it uses and discloses such information in accordance with the notices provided by such entities and the choices made by the individuals to whom such PII relates.

CHOICE: Without prejudice to any applicable law or regulation mandating PII processing or disclosure, BHI offers individuals the opportunity to choose (i.e., opt out) whether their PII is: (a) to be disclosed to a third party; or (b) to be used for the purpose that is incompatible with the purpose(s) for which it was originally collected or subsequently authorized by the individual.

BHI provides notice where PII will be shared or collected by third parties. BHI is committed to honor cases in which individuals express their objection (opt out) to have their data shared with, or collected by, other third parties. Yet, in cases where BHI has hired third party service providers to perform specific services (e.g., such as external medical research organizations for the conduct of clinical trials or payroll providers for payroll administration), and where the individual opts out as described above, BHI will not be able to provide that service.

BHI recognizes that EEA and Swiss citizens may request to opt out of sharing their PII with third parties in the future even after earlier agreeing to such sharing. Although BHI is committed to honor such requests (for future PII sharing), there may be limited cases in which BHI is under the legal obligation or has a legitimate interest in continuing sharing PII for a limited period of time. This is namely the case in which patients’ PII have to continue to be processed in the framework of a clinical trial and that not doing so might endanger the quality of the results or final outcome of the clinical trial. However, in these circumstances, BHI has taken measures to ensure that: (a) PII will only be used to the extent necessary for the quality of the clinical trial; and (b) the PII will not be used or shared for any other reason than for satisfying the scientific and medical needs of the clinical trials or applicable regulatory requirements. DATA INTEGRITY: BHI does not process PII in a way that is incompatible with the purposes for which it has been collected or subsequently authorized by the individual. To the extent necessary for those purposes, BHI will take reasonable steps to ensure that PII is reliable for its intended use, accurate, complete, and current.

TRANSFERS TO AGENTS: When disclosing PII from individuals in the EEA or Switzerland to a third party, BHI applies the Notice and Choice Principles. Where BHI wishes to transfer such PII to a third party that is acting as an agent, it will only do so if: (a) it first ascertains that the third party subscribes to the Principles; (b) is subject to EU Directive 95/46/EC, Swiss Federal Act on Data Protection and/or another adequacy finding; or (c) enters into a written agreement with the third party requiring that the third party provide at least the same level of privacy protection as is required by the Principles. Where BHI has knowledge that an agent is using or disclosing PII in a manner contrary to this Policy, it will take reasonable steps to prevent or stop the use or disclosure.

SECURITY: BHI takes reasonable precautions to protect PII in its possession from loss, misuse and unauthorized access, disclosure, alteration and destruction. Specifically, BHI established a data classification framework to help provide protection for all confidential PII and increased protection for Sensitive PII.

ACCESS AND CORRECTION: Upon request, BHI will grant individuals reasonable access to PII it holds about them. In addition, BHI will take reasonable steps to permit individuals to correct, amend, or delete information that is demonstrated to be inaccurate or incomplete.

ENFORCEMENT: BHI monitors compliance with the Principles through periodic privacy compliance assessments and, as necessary, audits, and provides a readily available and affordable recourse mechanism for individuals providing PII, as described in the Dispute Resolution section below.

DISPUTE RESOLUTION: Any questions, concerns or complaints regarding this Policy should be directed to BHI‘s Corporate Privacy and Compliance Office at the address given below. BHI will investigate and attempt to resolve complaints and disputes regarding this Policy. However, for complaints or disputes that cannot be resolved by BHI, it has agreed to participate in the following dispute resolution mechanisms: for disputes involving all PII received by BHI from Switzerland, BHI has agreed to cooperate with the Swiss FDPIC; and for disputes involving all PII received by BHI from the EEA, BHI has agreed to cooperate with the data protection authorities in the EEA and to participate in the dispute resolution procedures of the panel established by the European data protection authorities.

CONTACT INFORMATION Questions or comments regarding this Policy can be submitted to the BHI Privacy Office by mail to: Borromeo Housing, Inc. Attn: Privacy and Compliance 3304 Washington Blvd. Arlington, VA 22201 Or by telephone: 703-841-0139 Or by e-mail: information@borromeohousing.org

CHANGES TO THIS SAFE HARBOR PRIVACY POLICY STATEMENT This Policy may be amended from time to time, consistent with the requirements of the Principles. A notice will be posted on the privacy page of the BHI web site (www.borromeohousing.org) for at least 60 days whenever this Policy is changed in a material way.

EFFECTIVE DATE: December 1, 2013 For further information about the Safe Harbor Program, see the U.S. Department of Commerce website at http://www.export.gov/safeharbor/.

Legal Notices

The information in this presentation and document, including text, images, and links, and any accompanying materials, are PROVIDED "AS IS" BY Borromeo Housing, Inc. SOLELY AS A CONVENIENCE TO ITS VENDORS AND CUSTOMERS WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. Borromeo Housing, Inc. assumes no responsibility for errors or omissions in this publication or other documents which are referenced by or linked to this publication. This publication could include technical or other inaccuracies, and not all products or services referenced herein are available in all areas. Changes are periodically added to the information, and Borromeo Housing, Inc. may change the products or services described in this publication at any time. Contact Borromeo Housing, Inc. for further information before relying on any information contained herein.

Should you choose to respond directly to Borromeo Housing, Inc. with comments, questions, suggestions, ideas or the like relating to this document, materials, or any accompanying materials, or Borromeo Housing’s products and services, you agree that such information shall be deemed as non-confidential and Borromeo Housing shall have no obligation to respond and be free to reproduce, use, disclose and distribute the information to others without limitation, including but not limited to developing, manufacturing, and marketing products or services incorporating such information.

BHI Personal Data Protection Policy

You are hereby informed that whenever you log into the blog a certain amount of personal information will automatically and deliberately be collected, saved and used according to conditions defined below. If you do not wish this information to be collected, saved and used, you must inform the webmaster.

Personal information is collected, specifically, from the following sources:

the IP address you provide each time you log in;
automatic login or manually entered information that can be used to identify and/or contact you – name, address, telephone, fax, e-mail, company address or any other information that you agree to provide when you take part in discussion forums, online surveys and polls, when you request additional information on Borromeo Housing (such as, for example, marketing or advertising data), or when you subscribe to our newsletters, fill in registration forms or make other similar requests.

Personal data will be used only by Borromeo Housing and its affiliates and, unless otherwise specified at the time of collection, will not be divulged or shared with third parties for any reason whatsoever.

Personal data collected whenever you log in will be used to trace your path on the web site; this will allow Borromeo Housing to produce statistics about the pages that are visited and to review and improve the overall operation of the web site.

Personal data gathered whenever you participate in a discussion forum, online survey or poll, when you subscribe to our newsletter or when you make other similar requests will be used only for the purpose for which they were provided or collected. Subscriptions to newsletters can be cancelled at any time by sending an email to our webmaster.

You have the right to access, correct, amend or suppress any personal data, and you may exercise these rights at any time by sending an email to the webmaster, who will deal with your request as promptly as possible.

About BHI

Community Resources

Donate

Privacy Policy